Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on a client system which had a domain migration which seemed to have gone a bit wrong, about a year ago. However, in the event logs on a a member server, there are constant entries about a user (Administrator) that tries to login but fails (the domain of this account is on the old domain). I have recommended a colleague to use sysinternals etc to find the process using this account, but is there any definitive way to find what process is using this account?

Thanks Gurdeep

share|improve this question
In the failed event, you should have IP of client (if it's through the network) – Mathieu Chateau Apr 4 '12 at 22:36

I can only think of several places to look on a server
- Scheduled task - Service config - An icon using RunAs (although I don't think you can save the credentials)

I wouldn't think it would be too hard to review these manually.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.